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(54) A cryptographic device having reduced vulnerability to side-channel attack and method of 
operating same 



(57) A cryptographic device and method of opera- 
tion for encrypting messages. The device can be incor- 
porated into a postage metering system to provide 
cryptographically secured postal indicia. The device 
and method provide increased security against side- 
channel attacks such as differential power analysis 
(DPA). An encryption key is transformed with a first 
function to generate a temporary key as a function of a 
random number. A message is encrypted with the tem- 
porary key to generate a modified message. The modi- 
fied message is transformed with a second function to 
generate an encryption. The encryption generated is 
identical to a direct encryption of the message with the 
untransformed key. The temporary key is changed fre- 
quently to protect against side-channel attacks. 
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Description 

[0001 ] The present application shares common ele- 
ments of disclosure with commonly assigned, co-pend- 
ing European application number: 99125306.3; titled: 5 
SYSTEM AND METHOD FOR SUPPRESSING CON- 
DUCTED EMISSIONS BY A CRYPTOGRAPHIC 
DEVICE. 

[0002] The present invention relates generally to 
cryptographic devices and, more particularly, to crypto- w 
graphic devices having reduced vulnerability to side- 
channel attack and methods for operating such devices 
to reduce such vulnerability. Still more particularly it 
relates to such devices and methods incorporated into 
postage metering systems employing cryptographic 15 
processes for evidencing postage payment. 
[0003] Side channel attacks pose a significant 
threat to cryptographic systems. Such attacks involve 
analysis of related signals produced when an encrypted 
message is produced to obtain information which sim- 20 
plifies analysis of the cryptographic system under 
attack. One recently published technique of side chan- 
nel attack is differential power analysis (DPA). This tech- 
nique involves observation and analysis of fluctuations 
on the power line of a cryptographic device to determine 25 
the cryptographic secrets, i.e., the crypto keys, used by 
the device. 

[0004] DPA attacks allow an attacker to extract 
secret protected information from a supposedly secure 
cryptographic device by measuring variations in power 30 
consumption overtime, and then applying sophisticated 
analysis to this information. Any type of secure crypto- 
graphic device where such power variations are acces- 
sible is potentially susceptible to the attack. Such 
devices include smart cards, PC (PCMCIA) cards and 35 
printed circuit boards, Including devices that are housed 
within a protected enclosure 

[0005] The attack is based on the principle that as 
the cryptographic processor performs its cryptographic 
functions, such as encryption or signing; transistors 40 
comprising the processor switch on and off, which 
changes the amount of current drawn from the source 
supplying power to the processor. The attacker can cor- 
relate the current changes with data being processed 
and the crypto keys (hereinafter sometimes "keys") 45 
being used. The significance of the attack is as follows. 
[0006] Secure information systems are based on an 
assumption that the secret information, i.e., the crypto 
keys, stored within a secure cryptographic device are 
protected against disclosure to any attacker. It is well so 
known to use physical tamper- resistant or tamper-proof 
physical security to prevent such disclosure. With such 
physical security in effect, it has been assumed that an 
attacker without "cribs", i.e. information of some sort to 
simplify the analysis, could only obtain crypto keys 55 
either by trying all the possible crypto keys associated 
with the algorithm being used (symmetric algorithms) or 
by carrying out a complex mathematical search (asym- 



471 A2 




metric algorithms). For accepted cryptographic algo- 
rithms, this search is prohibitive, e.g. obtaining a 1024 
bit RSA key requires 230 years of 300 Mhz PC comput- 
ing. However, the DPA attack makes this assumption 
false. If the cryptographic device is subject to DPA 
attack, then the crypto key can be obtained in a matter 
of days or weeks using DPA. Thus it is imperative that 
the security community at large find means either to 
defeat this attack or to at least greatly lengthen the time 
and expertise needed to successfully carry it out. 
[0007] Many of the proposed countermeasures to 
the DPA attack involve the introduction of signal noise or 
filters on the power line, random timing and delays dur- 
ing cryptographic processing, and the introduction of 
extraneous operations. These countermeasures make 
the attack much more difficult by decreasing the amount 
of information obtained from each sampling of the 
power line signal. However, an attacker can overcome 
them by obtaining more samples of power line fluctua- 
tions and applying more sophisticated analytical tech- 
niques. Thus if a key is used sufficiently often it can be 
compromised by such attacks. Thus it would be advan- 
tageous to limit the amount of use of each particular key 
and ideally to use a different key for each message 
encrypted. However, this approach of substantially 
reducing usage creates great difficulty in the manage- 
ment of key distribution and is generally not useful out- 
side of military or similar applications where the number 
of parties using a key Is small. 

[0008] One application of cryptographic processes 
where it is anticipated that protection against side chan- 
nel attacks Will be important is in postage metering sys- 
tems. The vast majority of the Posts around the world 
require prepayment for postal services provided by the 
Posts. This allows the Posts to avoid the substantial 
time and cost associated with a post-payment system 
that requires processing billing data and collecting and 
processing remittance. Prepayment, however, necessi- 
tates that individual mailpieces carry verifiable evidence 
of paid postage. The traditional postage stamp is a 
prime example of such evidence. Postage meters which 
securely couple mechanical printing of postal indicia 
and accounting functions to assure that unpaid indicia 
are not printed are another well known means for evi- 
dencing postage payment. Postal revenue security in 
the such postage meters depends on two features: 1) 
physical security of the printing process, i.e., printing of 
postage evidence can not occur without appropriate 
accounting, and 2) forensic delegability, i.e., fraudulent 
postal indicia can be distinguished from legitimate indi- 
cia. 

[0009] Coupling the printing and accounting mech- 
anism within a secure tamper-evident enclosure pro- 
vides physical security of printing. Inspection of the 
device normally reveals tampering. Effective forensic 
delegability of fraudulent postal indicia depends on 
non-availability of alternative mechanisms suitable for 
forging indicia. Before the proliferation of inexpensive, 
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high print quality computer printers, serious attempts to 
generate fraudulent indicia using an alternate printing 
mechanism were detectable. 

[0010] Today, the availability of inexpensive compu- 
ter-driven printers provides opportunities for customer 5 
convenience and cost advantages for printing postage 
evidence. However, the use of such printers requires a 
new way of securing postage which was first suggested 
in U. S. Patents 4,641,347, 4,641,346, 4,757,537, and 
4,775,246. At that time, it was realized that the security 10 
of postage evidencing depends on the security of the 
information printed in the indicium, including message 
authentication and integrity. 

[0011] U. S. Patents 4,831,555 and 4,725,718 
extended this idea to unsecured printing of postage; dis- 75 
dosing the necessity that at least some of the informa- 
tion in the indicium must appear random to a party not 
in possession of some secret. Such random looking 
information is commonly referred to as a digital token. 
[0012] The basis of postal revenue security in the 20 
digital world is two new requirements: 1) security of the 
digital token generating process, i.e., digital tokens can 
not be generated without appropriate accounting, and 
2) automatic detectability, i.e., fraudulent digital tokens 
can be detected by automatic means. 25 
[0013] An encryption of selected data on the mail- 
piece with a secret key is one method for producing a 
digital token. The data may include postage value, date, 
postal code of the geographical deposit area, recipient 
address information, meter data, and piece count. Such 30 
data is commonly referred to as postal data. The secret 
key used to generate the digital token is generally held 
within the accounting device. A verifier, with access to a 
verifying key corresponding to the accounting device 
key, validates the digital token. Several cryptographic 35 
algorithms and protocols have been considered for this 
purpose. U. S. Patent 4,853,961 describes critical 
aspects of public-key cryptography for mailing applica- 
tions. See Jos6 Pastor, CRYPTOPOST "A Universal 
Information -Based Franking System for Automated Mail 40 
Processing, Proceedings of the Four the Advanced 
Technology Conference of the U. S. Postal Service, Vol. 
I, pp. 429*442, Nov. 1990. See also Jos6 Pastor, CRYP- 
TOPOST A Cryptographic Application to Mail Process- 
ing, Journal of Cryptology, 3 (2), pp. 137-146, Nov. 45 
1990. 

[0014] Two methods of presenting a postal verifier 
with fraudulent evidence of payment are a counterfeited 
indicium and a copied indicium. The former is an illegit- 
imately generated indicium that appears legitimate. The 50 
latter is a copy of a legitimate paid indicium. The subject 
invention addresses the prevention of counterfeit indicia 
by illegitimately obtaining a secret key and is not related 
to detection of copied indicia; which relies upon tech- 
niques such as detection of duplicate indicia. 55 
[0015] A counterfeit indicium can be detected by 
verifying the digital token. Verification proves that the 
digital token was generated by a cryptographic algo- 



rithm with access to the secret meter key. The informa- 
tion printed in the indicium and access to a verifying key 
are sufficient for the detection of counterfeited indicia as 
long as the secret meter key is confidential. In a public- 
key system, a digital signature provides the data 
authentication and integrity check. In a symmetric-key 
system a message authentication code (MAC) provides 
a similar check. 

[0016] Detection of counterfeiting is an integrity 
check. Assuming integrity of the verification software 
and hardware, only a compromised meter secret-key 
can reliably produce counterfeit indicia that passes an 
integrity check. This compromise could happen by vio- 
lating the physical protection of the key by tampering, or 
by deriving the key from indicia data by cryptanalysis. 
Generally, tampering is detectable if the physical protec- 
tion of the secure component of the postage metering 
system is adequate, for example following FIPS 140-1, 
Security Requirements for Cryptographic Modules, 
National Institute for Standards and Technology, Jan. 
1994. Robustness against cryptanalysis depends on 
the difficulty of solving certain mathematical problems, 
for example, discrete logarithm problems or factoring a 
large composite number, As part of its proposed Infor- 
mation-Based Indicia Program (IBIP), the USPS has 
proposed 1024 bit RSA or 1024 bit DSS as a measure 
of robustness. 

[0017] The IBIP is a distributed trusted system that 
is expected to support new methods of applying post- 
age in addition to, and eventually in lieu of, the current 
approach, which typically relies on a postage meter to 
mechanically print indicia on mailpieces. The IBIP 
requires printing large, high density, two dimensional (2- 
D) barcodes on mailpieces. The Postal Service expects 
the IBIP to provide cost-effective assurance of postage 
payment for each mailpiece processed. The USPS has 
published draft specifications for the IBIP. The INFOR- 
MATION BASED INDICIA PROGRAM (IBIP) INDICIUM 
SPECIFICATION, dated June 13, 1 996, defines the pro- 
posed requirements for a new indicium that will be 
applied to mail being processed using the IBIP. The 
INFORMATION BASED INDICIA PROGRAM POSTAL 
SECURITY DEVICE SPECIFICATION, dated June 13, 
1996, defines the proposed requirements for a Postal 
Security Device (PSD) that will provide security services 
to support the creation of a new "information based- 
postage postmark or indicium that will be applied to mail 
being processed using the IBIP. The INFORMATION 
BASED INDICIA PROGRAM HOST SYSTEM SPECI- 
FICATION, dated October 9, 1996, defines the pro- 
posed requirements for a host system element of the 
IBIP. The specifications are collectively referred to 
herein as the "IBIP Specifications". The IBIP includes 
interfacing user (customer), postal and vendor infra- 
structures which are the system elements of the pro- 
gram. 

[0018] There are three information security objec- 
tives critical for postage evidencing: authentication, 
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wherein a Post can read a payment message printed on 
a mailpiece and identify the postage accounting device 
responsible for the message; data integrity, wherein the 
Post can detect any alteration of the payment message: 
and evidence of fraud, wherein the Post can detect evi- 5 
dence of fraud, such as a mailpiece with a counterfeited 
indicium or mailpieces with identical indicia. 
[0019] In order to achieve authentication, the pay- 
ment message must include a unique postage account- 
ing device identification number and a message 
identification number, for example, a serial piece count 
or ascending register. The integrity of the payment itself 
requires inclusion of the postage amount. These ele- 
ments, collectively referred to as postal or security data, 
represent a minimal set. Depending on the verification 
strategy additional elements, including delivery address 
information, may be included. An indicium should, at a 
minimum, contain: 1 ) the security data, and 2) the digital 
token produced by an encryption of the security data. 
Cryptographic authentication proves integrity of these 
elements. 

[0020] Presently, there are two postage metering 
types: closed systems and open systems. In a closed 
system, the system functionality is solely dedicated to 
metering activity. Examples of closed system metering 
devices include conventional digital and analog 
(mechanical and electronic) postage meters wherein a 
dedicated printer is securely coupled to a metering or 
accounting function. In a closed system, since the 
printer is securely coupled and dedicated to the meter, 
printing evidence of postage cannot take place without 
accounting for the evidence of postage. In an open sys- 
tem, the printer is not dedicated to the metering activity, 
freeing system functionality for multiple and diverse 
uses in addition to the metering activity. Examples of 
open system metering devices include personal compu- 
ter (PC) based devices with single/multi-tasking operat- 
ing systems, multi-user applications and digital printers. 
An open system metering device is a postage evidenc- 
ing device with a non-dedicated printer that is not 
securely coupled to a secure accounting module. Open 
system indicia printed by the non-dedicated printer are 
made secure by including addressee information in the 
encrypted evidence of postage printed on the mailpiece 
for subsequent verification. 

[0021] Conventional closed system mechanical and 
electronic postage meters have heretofore secured the 
link between printing and accounting. The integrity of 
the physical meter box has been monitored by periodic 
inspections of the meters. Digital printing postage 
meters, which are closed system postage meters, typi- 
cally include a digital printer coupled to a metering 
(accounting) device, which is referred to herein as a 
postal security device (PSD). Digital printing postage 
meters have removed the need for physical inspection 
by cryptographically securing the link between the 
accounting and printing mechanisms. In essence, new 
digital printing postage meters create a secure point to 



point communication link between the accounting unit 
and printhead. That is an indicium printed without 
accounting for postage will be detected. See, for exam- 
ple. U.S. Patent No. 4,802,21 8, issued to Christopher B. 
Wright et al and now assigned to the assignee of the 
present invention. An example of a digital printing post- 
age meter with secure printhead communication is the 
Personal Post Office™ manufactured by Pitney Bowes 
Inc. of Stamford, Connecticut, USA. An example of a 
digital printing postage meter in a secure housing is the 
Post Perfect™ also manufactured by Pitney Bowes Inc. 
[0022] It will be apparent from the above discussion 
that protection of secret meter keys is critical to the suc- 
cess of new meter technologies such as the IBIP. Com- 
promise of a meter secret key can allow the generation 
of counterfeit indicia which cannot be detected by cryp- 
tographic verification, while the reduced need for physi- 
cal inspection of the meters may increase opportunities 
for side-channel attacks such as DPA. 
[0023] Thus it is an object of the subject invention to 
provide cryptographic devices and methods for opera- 
tion of such devices which reduce the vulnerability to 
side-channel attacks, particularly DPA. 
[0024] The above object is achieved and the disad- 
vantages of the prior art are overcome in accordance 
with the subject invention by means of a cryptographic 
device and a method for operating such a device which 
include; 

a) storing a key e and an encryption function E(x,y), 
where E(x,y) is an encryption of an arbitrary mes- 
sage x with an arbitrary key y in the device; 

b) storing a first, resistant function (y,t) and a sec- 
ond function F 2 (x,t), where t is an arbitrary integer 
and F 2 ( E(x, F^y.t)), t) = E(x,y) in the device; and 
then controlling the device to 

c) input a message m for encryption; 

d) select a random number r; 

e) generate a temporary key F«t(e,r); 

f) generate E(m, F^e.r)); 

g) generate F 2 ( E(m, F^e.r)), r) = E(m,e) as an 
encryption c of the message m with the key e; and 

h) output the encryption c. 

[0025] Thus signals generated by said device which 
are susceptible to side-channel attack will vary with the 
random number r thus reducing the vulnerability of the 
key e to side channel analysis. 
[0026] In accordance with one aspect of the subject 
invention, where n is a secret number equal to p times 
q, where p and q are secret prime numbers, and where 
cj>(n) is the number of positive integers less than or equal 
to n that are relatively prime to n: 

a) the encryption function E(x,y) equals x y mod(n); 

b) the first function F^y.t) equals (y)(1/t mod(<|> (n))); 
and 

c) the second function F 2 (xt) equals x* mod(n); with 
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the result that 

d) F 2 ( E(m, F^e.r)), r) = (m 6 " mod(n)) r mod(n) , 
where the exponent e/r is taken to be (e)(1/r mod(<)> 
(n))), equals m e mod(n), as the encryption c of the 
message m; whereby a recipient of the encryption c s 
can recover the message m as c d mod(n), where 
(e)(d)=1mod(<Mn)). 

[0027] In accordance with another aspect of the 
subject invention the message m includes postal data 10 
and the encryption c is incorporated into a postal indi- 
cium. 

[0028] In accordance with another aspect of the 
subject invention values for r are generated by a random 
number generator. is 
[0029] In accordance with another aspect of the 
subject invention values for r and (1/r mod(<)> (n))) are 
selected from a table of predetermined values. 
[0030] In accordance with still another aspect of the 
subject invention, where the computational burden is 20 
distributed between the message originator and mes- 
sage recipient, the device is operated to: 

a) store a key e and an encryption function E(x,y), 
where E(x f y) is an encryption of an arbitrary mes- 25 
sage x with an arbitrary key y in the device; 

b) store a first, resistant function F 1 (y,t) and a sec- 
ond function F 2 (x,t), where t is an arbitrary integer 
and F 2 (E(x, F 1 (y,t)), t) = E(x,y) in the device; and 
then to 30 

c) input a message m for encryption; 

d) select a random number r; 

e) generate a temporary key F^e.r); 

f) generate E(m, F^e.r)); and the to 

g) output E(m, F^e.r)), the message recipient 35 
being provided with the random number r. The 
message recipient can generate F 2 ( E(m, 
F.,(e,r)), r) = E(m,e) as an encryption c of said 
message m with said key e, and then decrypt said 
encryption c. 40 

[0031] Other objects and advantages of the subject 
invention will be apparent to those skilled in the art from 
consideration of the attached drawings and the detailed 
description set forth below. 45 
[0032] In which like reference characters refer to 
like parts or steps throughout: 

Figure 1 shows a cryptographic device used in a 

postage metering system for the generation of cryp- so 

tographicalty secured postal indicia. 

Figure 2 shows a flow diagram of the operation of 

the device of Figure 1 in accordance with one 

embodiment of the subject invention. 

Figure 3 shows a flow diagram of the operation of 55 

the device of Figure 1 in accordance with another 

embodiment of the subject invention. 

Figure 4 shows a flow diagram of the decryption of 



a message generated in accordance with Figure 3. 

[0033] Referring now to Figure 1 , a block diagram of 
a cryptographic device, generally designated 10, is 
shown. Cryptographic device 10 includes a conven- 
tional processor 20, coupled to an optional coprocessor 
22, non-volatile memory 24, random access memory 26 
and read-only memory 28. Cryptographic device 10 is 
enclosed within a secure housing 34. The secure hous- 
ing 34 may be any conventional means for preventing 
access to cryptographic device 1 0. For example, secure 
housing 34 may be an integrated circuit chip encased in 
an epoxy that prevents access to the integrated circuit 
without destruction of the integrated circuit. Power to 
cryptographic device 10 is input at power line 30. 
Input/output communications occur at I/O line 32. It will 
be understood that cryptographic device 10 may be 
implemented as any number of discrete components or 
as a single integrated circuit, such as a smart card. 
[0034] In a preferred embodiment of the subject 
invention read-only memory 28 stores program code to 
control device 10 to function in a postage metering sys- 
tem to generate secure postal indicia and account for 
postage expenditure as described above. Postal data is 
input through I/O line 32 and processor 20 operates in 
accordance with the program code to generate a corre- 
sponding postal indicium, account for postage 
expended in account registers in non-volatile memory 
24, and control a printer (not shown) to print the indi- 
cium. Read-only memory 28 stores initial information, 
such as a meter identification number and an encryp- 
tion key, used to generate the indicium. 
[0035] The general operation of such metering sys- 
tems is known and is described, for example in the 
above mentioned U. S. Patents nos.: 4,831,555 and 
4,725,718 and IBIP specifications. Except as set forth 
below, a more detailed discussion of the operation of 
postage metering systems is not believed necessary for 
an understanding of the subject invention. 
[0036] Figure 2 shows a flow diagram of the opera- 
tion of device 1 0 to encrypt postal data for incorporation 
into indicia to provide security. In other embodiments of 
the subject invention other types of messages can be 
encrypted in a substantially identical manner. 
[0037] Preferably the encryption operations 
described below are carried out by optional coprocessor 
22 but, in embodiments where coprocessor 22 is omit- 
ted they can be carried out by processor 20, albeit more 
slowly. 

[0038] At 50 device 10 is initialized by storing at 
least an encryption key e and, preferably initial informa- 
tion used to identify the postage metering system incor- 
porating device 1 0. 

[0039] Preferably, this initial information is incorpo- 
rated into the postal data by processor 20 or coproces- 
sor 22 in the input process to form a message m for 
encryption. 

[0040] (Those skilled in the art will recognize that in 
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a postage metering system device 1 0 carries out a sign- 
ing operation; that is a message, or more typically a 
selected portion of a message generated by applying a 
"hashing" function to the message, is encrypted for the 
purpose of verifying the source and/or authorization of 5 
the message rather for the purpose of concealing the 
message contents.) 

[0041] Thereafter, when processing of an indicium 
begins, at 52 device 10 selects a random number r in 
any convenient manner which can include provision of a 10 
conventional random number generator to generate a 
number for each indicium, or selection of random 
number r from a predetermined table of random num- 
bers. As used herein random number r can also be a 
product of particular random numbers rj of the general 15 
form:(r/)(r 2 V.(r m M )- 

[0042] (It should be noted that the term "random 
number" as used herein is not intended to imply that the 
sequence of numbers used in a series of encryption 
operations will satisfy mathematical tests of random- 20 
ness, though this may be preferred as providing a 
higher degree of security. Rather since, as discussed 
below, knowledge of particular values of r will not help 
an attacker recover the key used herein, it is sufficient 
that the term 'random number" as used herein means 25 
only that values of r are selected in any convenient man- 
ner, such as from pre-computed tables, which will 
assure that any particular value of r is not used so often, 
or so regularly, as to permit recovery of F^e.r) through 
DPA; which Includes, but is not limited to sequences of 30 
values of r which satisfy mathematical tests of random- 
ness.) 

[0043] Then, at 56, device 10 operates on encryp- 
tion key e with a predetermined, resistant function 
Fi(y.t), where t is an arbitrary integer, which function is 35 
preferably stored as an algorithm incorporated in the 
program code, to generate a temporary key F^e.r). 
[0044] It should be noted that the value of the key is 
exposed to DPA attack when a temporary key F^e^) is 
computed and that accordingly the term "resistant f unc- 40 
tions", as used herein, means a function which is sub- 
stantially more resistant to DPA attack than the 
encryption function. Proper selection of such a resistant 
function is described further below with respect to pre- 
ferred RSA embodiments. 45 
[0045] Then, at 60, device 10 encrypts message m 
with an encryption function E(x,y), where E(x,y) is an 
encryption of an arbitrary message x with an arbitrary 
key y using temporary key F^e.r) to form E(m, F^e.r)). 
[0046] Then, at 62, device 10 operates on E(m, so 
F^e.r)) with a predetermined function F 2 (x,t), which is 
preferably stored as an algorithm incorporated in the 
program code, to generate F 2 (E(m, F^(e,r)),r), In 
accordance with the subject invention the functions 
and F 2 are selected so that 55 

F 2 ( E(x, F^y.t)), t) = E(x,y) and therefore: 

F 2 ( E(m, F^e.r)), r) = E(m,e) , i.e. is an encryption 



0 of said message m with said key e. 

[0047] Then, at 64 device 10 outputs encryption c 
for incorporation in a postal indicium in accordance with 
conventional postal system operations or, in other 
embodiments, directly to a recipient, and then exits. 
[0048] Those skilled in the art will recognize from 
the above discussion that the temporary key used in the 
encryption carried out at step can be changed as fre- 
quently as desired; as often as for each message. Thus 
it is believed that the temporary key can be made sub- 
stantially immune to side-channel attacks, particularly 
DPA attacks, which generally require a relatively large 
number of samples of the power line signal to determine 
the key in use. And, without knowledge of the temporary 
key even an attacker with knowledge of r cannot deter- 
mine key e. It should also be noted that encryption c is 
identically E(m,e) and that thus no other changes in nor- 
mal postage metering system operation are needed; 
nor, in other embodiments, is any additional burden 
placed on message recipients. 
[0049] Figure 3 shows a flow diagram of encryption 
in accordance with another embodiment of the subject 
invention where some of the computational burden is 
shifted to the message recipient. In Figure 3 steps 50, 
52, 54, 56, and 60 are carried out by device 1 0 in the 
manner described above to obtain E(m, F^e.r)). Then 
at 68 device 10 outputs a modified message E(m, 
Fi(e,r)), r, where r is appended in plain text. As dis- 
cussed above even with knowledge of r an attacker will 
gain no advantage in determining either the temporary 
key F^e.r) or key e. It should be noted that this embod- 
iment will require some modifications to postage meter- 
ing functions (which will be readily within the ability of 
those skilled in the art) to incorporate the modified mes- 
sage into postal indicia; and, as described further 
below, will require that message recipients know F 2 . 
[0050] Figure 4 shows the operation of a message 
recipient in recovering message m from a message 
transmitted in accordance with Figure 3. At 70 the mes- 
sage recipient, which is preferably a programmable data 
processing system, is initialized with a decryption func- 
tion D and a decryption key d corresponding to encryp- 
tion function E, and key e. 

[0051] In other embodiments of the subject inven- 
tion r is not appended to the message but is provided to 
the recipient in any other convenient manner, such as 
by secure distribution of pre-computed tables. 
[0052] Then at 72 the message recipient receives 
E(m, F^e.r)), r. In the preferred application where 
device 10 is incorporated into a postage metering sys- 
tem the modified message will be recovered from a 
postal indicium to validate the indicium. 
[0053] Then, at 74, the message recipient gener- 
ates F 2 ( E(m, F^e.r)), r)= E(m,e) , encryption c of 
said message m with said key e; and at 76 uses Func- 
tion D and key d to decrypt c in a normal manner, and 
exits. In another preferred embodiment messages are 
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encrypted and decrypted with a public key system using 
exponentiation mod(n) such as the well known RSA 
system. In such systems n is a secret number equal to 
p times q, where p and q are secret prime numbers, and 
<(> (n) is defined as the number of positive integers less 5 
than or equal to n that are relatively prime to n. In this 
embodiment: 

encryption function E(x,y) equals x y mod(n); 
first function F^yt) equals (y)(1/t mod((<)>(n))): and 
second function F 2 (x,t) equals x* mod(n). 

[0054] Under these conditions it can be proven that 
[mP* mod(n)} r mod(n), where r is a random number as 
described above and the exponent e/r is taken to be 
(e)(1/r mod((<|> (n))), equals m e mod(n), which is identi- 
cally the encryption c of the message m with key e. A 
recipient of encryption c can recover message m 
in the normal manner as c d = mmod(n), where 
e times d = 1 mod(<|> (n)) . 
[0055] In other embodiments of the subject inven- 
tion where the computational burden is distributed, 
either r or 1/r can be chosen to be small to reduce the 
computational burden on either the message originator 
or the verifier as preferred for various applications. The 
random number r can be chosen to be small to 
decrease the time required to perform the exponentia- 
tion; note however that it is not feasible to chose both r 
and 

(1/r rnod(<p (n)) to be small. Also, since 
(1/r mod($ (n))" 1 = r mod (<fr (n)) , r and r" 1 can be inter- 
changed to decrease the required computation time of 
either the signer or the verifier. 
[0056] It is believed that function satisfies the 
requirement discussed above and is more resistant 
than E since the computation of (y)(1/t mod(($ (n))) is 
very short compared to the computation time for x y 
mod(n) and uses the bits in a different way and is so 
easier to protect from DPA attacks. 
[0057] (The term "congruent" and symbol are 
commonly used in mathematical treatments of modular 
arithmetic rather than the more familiar equal" and "=". 
However those skilled in the art will readily understand 
the usage chosen in the present application for reasons 
of simplicity.) 45 
[0058] It should also be noted that calculation of 1/r 
mod(($ (n)) may expose 4 (n), and so e, to DPA attack 
so it is preferable that care be exercised in when and 
how values of 1/t are computed. For this reason the use 
of tables of pairs (r, 1/r), with off line pre-computation of 50 
1/r, may be preferred. 

[0059] Consideration of the relations set forth 
above: 

m e = c mod(n); and 55 
c d = m mod(n) 



immediately shows the reversibility of such public key 
systems. That is, the encryption and decryption proc- 
esses are computationally the same and differ only in 
the meanings given to message m and encryption c. 
The subject invention has been described above in 
terms of applications such as signing messages where 
the security of the encryption key e is critical to prevent 
counterfeiting of digital signatures but where the 
decryption key can be the public key in a public key sys- 
tem without loss of security. In other applications of pub- 
lic key systems, where security of the message content 
is critical the message can be encrypted with a known 
public key and it is the security of the decryption key 
which is critical. Since encryption and decryption are 
computationally the same the subject invention can be 
used to protect decryption keys in such applications in 
the manner described above and the term "encryption" 
as used herein should be understood to include decryp- 
tion in such reversible applications. That is, as noted, in 
the postage metering embodiments discussed the 
encrypted message is a signature used to authenticate 
a postal indicium. In other applications of public key 
encryption, whore messages are encrypted with a 
known public key to protect the message content, meth- 
ods substantially as described with respect to Figures 2, 
and 3 and 4 can be used to protect the private key used 
to decrypt the message. 

[0060] The embodiments described above and 
illustrated in the attached drawings have been given by 
way of example and illustration only from the teaching of 
the present application those skilled in the art will read- 
ily recognize numerous other embodiments in accord- 
ance with the subject invention. In particular it will be 
recognized that the subject invention can be used to 
protect other uses of encryption keys, such as postage 
meter refills, where a meter is recharged with funds to 
allow continued printing of indicia. Accordingly, limita- 
tions on the subject invention are to be found only in the 
claims set forth below. 



1 . A method for operating a cryptographic device, said 
method comprising the steps of: 

a) storing a key e and an encryption function 
E(x,y), where E(x,y) is an encryption of an arbi- 
trary message x with an arbitrary key y; 

b) storing a first, resistant function F^yt) and a 
second function F 2 (x,t), where t is an arbitrary 
integer and F 2 ( E(x, F^y.t), = E(x,y) ; 

c) inputting a message m for encryption; 

d) selecting a random number r 

e) generating a temporary key F^e.r); 

f) generating E(m, F^e.r)); 

g) generating F 2 ( E(m, F^e.r)), r) = E(m,e) 
as an encryption c of said message m with said 
key e; and 
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h) outputting encryption c; whereby 

i) signals generated by said device which are 
susceptible to side-channel attack will vary with 
said random number r thus reducing the vul- 
nerability of said key e to side channel analysis. 5 

2. A method as described in claim 1, where n is a 
secret number equal to p times q, where p and q 
are secret prime numbers, and where 4 (n) is the 
number of positive integers less than or equal to n io 
that are relatively prime to n, and wherein: 

a) said encryption function E(x,y) equals x y 
mod(n); 

b) said first function F^yt) equals (y)(1/t mod(<j> is 
(n))); and 

c) said second function F 2 {x,t) equals x* 
mod(n); whereby 

d) F 2 ( E(m, F^e.r)), r) = (m e/r mod(n)) r mod 
(n), where the exponent e/r is taken to be 20 
(e)(1/r mod($ (n))), equals m e mod(n), as said 
encryption c of said message m; whereby a 
recipient of said encryption c can recover said 
message m as c d mod(n), where 
(e)(d) =1 modW (n)) . 25 

3. A method for operating a cryptographic device, said 
method comprising the steps of: 

a) storing a key e and an encryption function 30 
E(x,y), where E(x,y) is an encryption of an arbi- 
trary message x with an arbitrary key y; 

b) storing a first, resistant function F^yt) and 
providing a message recipient with a second 
function F 2 (x,t), where t is an arbitrary integer 35 
and F 2 (E(x,F 1 (y,t)),t) = E(x,y); 

c) inputting a message m for encryption: 

d) selecting a random number r 

e) generating a temporary key F^e.r); 

f) generating E(m, F^e.r)); 40 

g) outputting E(m, F^e.r)), said message recip- 
ient being provided with said random number r; 
whereby 

h) said message recipient can generate 
F 2 ( E(m, F^e.r)), r)= E(m,e) as an encryp- 45 
tion c of said message m with said key e, and 
then decrypt said encryption c; and whereby 

i) signals generated by said device which are 
susceptible to side-channel attack wilt vary with 
said random number r thus reducing the vul- so 
nerability of said key e to side channel analysis. 

4. A method as described in claim 3, where n is a 
secret number equal to p times q, where p and q 

are secret prime numbers, and where <fr (n) is the 55 
number of positive integers less than or equal to n 
that are relatively prime to n, and wherein: 



a) said encryption function E(x,y) equals x y 
mod(n); 

b) said first function F^yt) equals (y)(1 A mod(<|> 
(n))); and 

c) said second function F 2 (x,t) equals x* 
mod(n); whereby 

d) F 2 ( E(m, F^e.r)), r) = (m 6 " mod(n)) r mod 
(n), where the exponent e/r is taken to be 
(e)(1/r mod(<|> (n))). equals m e mod(n), as said 
encryption c of said message m; whereby said 
message recipient can recover said message 
m as c d mod(n), where (e)(d) = 1 mod(<(> (n)) . 

5. A method as described in claim 2 or claim 4, 
wherein said message m includes postal data and 
said encryption c is incorporated into a postal indi- 
cium. 

6. A method as described in claim 1 or claim 2 or 
claim 3 or claim 4 wherein values for r are gener- 
ated by a random number generator. 

7. A method as described in claim 2 or claim 4 
wherein values for r and (1/r mod(<j>(n))) are 
selected from a table of predetermined values. 

8. A method as described in claim 1 or claim 3, 
wherein said message m includes postal data and 
said encryption c is incorporated into a postal indi- 
cium. 

9. A method as described in claim 1 or claim 3 
wherein values for r are selected from a table of 
predetermined values. 

10. A method for operating a cryptographic device, said 
method comprising the steps of: 

a) storing a key d and an decryption function 
D(x,y), where D(x,y) is a decryption of an arbi- 
trary message x with an arbitrary key y and a 
decryption key d; 

b) storing a second function F 2 (x,t), where t is 
an arbitrary integer and 

F 2 ( E(x, F^yt)), t) = E(x,y) , wherein E(x,y) is 
an encryption function corresponding to 
decryption function D(x,y); 

c) receiving a modified message E(m, F^e.r)), 
where e is an encryption key corresponding to 
said encryption key d, and r is a random 
number, and F1 is a resistant function; 

d) obtaining r; 

e) generating F 2 ( E(m, F^e.r)), r) = E(m,e) as 
an encryption c of said message m with said 
key e; and 

f) decrypting encryption c; whereby 

g) signals generated in producing said modified 
message which are susceptible to side-chan- 
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nel attack will vary with said random number r 
thus reducing the vulnerability of said key e to 
side channel analysis. 

11. A method as described in claim 10, where n is a 5 
secret number equal to p times q, where p and q 
are secret prime numbers, and where <j>(n) is the 
number of positive integers less than or equal to n 
that are relatively prime to n f and wherein: 

10 

a) said encryption function E(x,y) and said 
decryption function D(x,y) equal 

x y mod(n); 

b) said first function (y,t) equals (y)(1/t mod(<J> 
(n))); and 15 

c) said second function F 2 (x,t) equals x* 
mod(n); whereby 

d) F 2 ( E(m, F^e.r)), r) = (m e/r mod(n)) r mod 
(n), where the exponent e/r is taken to be 
(e)(1/r mod(<)> (n))), equals m e mod(n), as said 20 
encryption c of said message m; whereby a 
recipient of said encryption c can recover said 
message m as c d mod(n), where 
(e)(d) = 1 mod(<|> (n)) . 

25 

12. A method as described in claim 11, wherein said 
message m includes postal data and said encryp- 
tion c is incorporated into a postal indicium. 

1 3. A method for encrypting a message m, said method 30 
comprising the steps of: 

a) transforming an encryption key e with a first, 
resistant function to generate a temporary key: 

b) encrypting said message with said tempo- 35 
rary key to generate a modified message; 

c) transforming said modified message with a 
second function to generate an encryption c; 
said encryption c being identically equal to a 
direct encryption of said message m with said 40 
key e. 

14. A method for encrypting a message m, said mes- 
sage being sent to a recipient who possesses a 
second function, said method comprising the steps 45 
of: 

a) transforming an encryption key e with a first, 
resistant function to generate a temporary key; 

b) encrypting said message with said tempo- so 
rary key to generate a modified message; and 

c) sending said message m to said recipient; 
whereby 

d) said recipient can transform said modified 
message with said second function to generate 55 
an encryption c; said encryption c being identi- 
cally equal to a direct encryption of said mes- 
sage m with said key e, and thereafter decrypt 
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said message m. 

15. A method as described in claim 10 or claim 13 or 
claim 14, wherein said message m includes postal 
data and said encryption c is incorporated into a 
postal indicium. 

16. A cryptographic device, comprising: 

a) a data store storing a key e for an encryption 
function E(x,y), where E(x,y) is an encryption of 
an arbitrary message x with an arbitrary key y; 

b) an input; 

c) an output; 

d) a processor controlling said cryptographic 
device, said processor being programmed to: 

d1) receive a message m for encryption 

from said input; 

d2) select a random number r; 

d3) generate a temporary key F^e.r), 

where F1 vs a resistant function: 

d4) generate E(m, F^e.r)); 

d5) generate F 2 ( E(m, F^e.r)), r); wherein 

d6) F-i and F 2 are selected so that 

F 2 (E(x,F 1 (y,t)), n) = E(x,y), where t is 

an arbitrary integer, whereby 

F 2 ( E(m, F ^e.r)), r) = E(m,e) as an 

encryption c of said message m with said 

key c; and 

e) transmit said encryption c to said output 
whereby 

f) signal's generated by said device which are 
susceptible to side-channel attack will vary with 
said random number r thus reducing the vul- 
nerability of said key e to side channel analysis. 

17. A cryptographic device as described in claim 16, 
where n is a secret number equal to p times q, 
where p and q are secret prime numbers, and 
where <j> (n) is the number of positive integers less 
than or equal to n that are relatively prime to n, and 
wherein: 

a) said encryption function E(x,y) equals x y 
mod(n); 

b) said first function F 1 (y,t) equals (y)(1/t mod(<fr 
(n))); and 

c) said second function F 2 (x,t) equals x l 
mod(n); whereby 

d) F 2 ( E(m, F^e.r)), r) = (m 6 * mod(n)) r mod 
(n), where the exponent e/r is taken to be 
(e)(1/r mod($ (n))), equals m e mod(n), as said 
encryption c of said message m; whereby a 
recipient of said encryption c can recover said 
message m as c d mod(n), where 
(e)(d)=1mod(* (n)). 
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18. A cryptographic device as described in claim 17, 
wherein said device comprises a postage metering 
system and said message m includes postal data 
and said encryption c is incorporated into a postal 
indicium. 5 

19. A cryptographic device as described in claim 16, 
wherein said device comprises a postage metering 
system and said message m includes postal data 
and said encryption c is incorporated into a postal w 
indicium. 
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